ThreatHunter76/Incident-Response-Investigation

# SOC 事件响应调查实验室 ## 项目概述 本项目展示了使用 Splunk SIEM 进行的一次完整的安全运营中心 (SOC) 事件调查。调查重点在于识别和分析涉及可疑身份验证活动、恶意软件执行、PowerShell 滥用、命令与控制 (C2) 通信以及可能的数据外泄的钓鱼型入侵。 本项目的目标是通过关联多个日志源、识别入侵指标 (IOC)、重建攻击时间线以及建议遏制和补救措施，来模拟真实的 SOC 分析师工作流程。 # 项目目标 - 调查可疑的身份验证活动 - 检测可能的暴力破解或撞库攻击 - 分析恶意软件执行行为 - 调查可疑的 PowerShell 活动 - 检测命令与控制 (C2) 通信 - 识别可能的数据外泄活动 - 关联多个日志源中的事件 - 制定事件响应和遏制建议 # 使用的工具与技术 | 工具 | 用途 | |---|---| | Splunk Enterprise | SIEM 和日志分析 | | Sysmon | 进程和端点遥测 | | Microsoft Defender | 恶意软件检测 | | Kali Linux | SOC 实验环境 | | CSV 日志源 | 模拟的企业日志 | # 分析的日志源 - Windows 安全日志 - Sysmon 日志 - DNS 日志 - Defender 日志 - 网络流量日志 - 防火墙日志 - VPN 日志 - 帮助台/用户报告 # 事件摘要 在调查期间，发现针对以下用户账户的多次失败登录尝试： ``` j.adewale A successful authentication event was later observed from the same external IP address, indicating a possible credential compromise. Shortly afterward, a suspicious executable: update_kb5031.exe was executed from the user’s Temp directory by: OUTLOOK.EXE Further analysis revealed: Encoded PowerShell execution Suspicious DNS queries Malware detection alerts Large outbound HTTPS traffic Possible Command & Control communication Potential data exfiltration activity The investigation concluded that the attack likely originated from a phishing email leading to malware execution and post-exploitation activity. Key Indicators of Compromise (IOCs) Malicious IP Addresses 185.193.88.71 45.77.91.203 197.210.77.19 Suspicious Domain cdn-updates365.com Malicious File update_kb5031.exe Suspicious PowerShell Indicators -enc -nop -w hidden Splunk Queries Used Authentication Investigation index=soc_lab EventCode=4625 OR EventCode=4624 Malware Investigation index=soc_lab update_kb5031.exe PowerShell Investigation index=soc_lab powershell.exe DNS Investigation index=soc_lab cdn-updates365.com Data Exfiltration Investigation index=soc_lab BYTES_OUT>10000000 Attack Chain Identified Phishing Email ↓ OUTLOOK.EXE ↓ update_kb5031.exe ↓ Encoded PowerShell Execution ↓ Suspicious DNS Queries ↓ Outbound HTTPS Traffic ↓ Possible Data Exfiltration MITRE ATT&CK Techniques Observed Tactic Technique Initial Access Phishing Credential Access Brute Force / Credential Stuffing Execution PowerShell Defense Evasion Obfuscated/Encoded Commands Command & Control Application Layer Protocol Exfiltration Exfiltration Over Web Services Containment Actions Recommended Isolate the affected endpoint from the network. Disable or reset compromised user accounts. Block malicious IP addresses and suspicious domains. Terminate malicious PowerShell and suspicious processes. Remove the malicious executable from affected systems. Re-enable endpoint protection and perform full malware scans. Investigate for lateral movement and additional compromised hosts. Preserve forensic evidence for further analysis. Key Lessons Learned This project demonstrated the importance of: SIEM-based threat detection Event correlation Authentication monitoring Process analysis DNS investigation PowerShell abuse detection Network traffic analysis Incident response workflow The investigation also highlighted how attackers combine phishing, malware execution, PowerShell abuse, and encrypted outbound traffic to compromise enterprise environments. Skills Demonstrated SIEM Investigation Threat Hunting Log Correlation IOC Identification Malware Analysis PowerShell Investigation Incident Response Network Traffic Analysis Splunk Querying SOC Workflow Analysis Conclusion This SOC investigation successfully identified a phishing-led compromise involving suspicious authentication activity, malware execution, encoded PowerShell abuse, suspicious DNS communication, and potential data exfiltration. By correlating logs across multiple security sources, the attack timeline was reconstructed and critical Indicators of Compromise were identified. This project demonstrates practical SOC analyst investigation techniques and real-world incident response methodology using Splunk SIEM. ```

标签：安全运营中心, 实验室环境, 库, 应急响应, 网络映射